Skip to content

Commit c2a98be

Browse files
vijaykanthmPhilip Jonany
vijaykanthm
authored and
Philip Jonany
committed
Add Resource v1 SCC Findings Export to BQ Organization Config (GoogleCloudPlatform#11582)
1 parent e6e7d86 commit c2a98be

File tree

3 files changed

+284
-0
lines changed

3 files changed

+284
-0
lines changed

‎mmv1/products/securitycenter/OrganizationSccBigQueryExport.yaml

+135
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
--- !ruby/object:Api::Resource
15+
name: 'OrganizationSccBigQueryExport'
16+
base_url: organizations/{{organization}}/bigQueryExports
17+
self_link: organizations/{{organization}}/bigQueryExports/{{big_query_export_id}}
18+
create_url: organizations/{{organization}}/bigQueryExports?bigQueryExportId={{big_query_export_id}}
19+
update_verb: :PATCH
20+
update_mask: true
21+
import_format:
22+
- 'organizations/{{organization}}/bigQueryExports/{{big_query_export_id}}'
23+
description: |
24+
A Cloud Security Command Center (Cloud SCC) Big Query Export Config.
25+
It represents exporting Security Command Center data, including assets, findings, and security marks
26+
using gcloud scc bqexports
27+
~> **Note:** In order to use Cloud SCC resources, your organization must be enrolled
28+
in [SCC Standard/Premium](https://cloud.google.com/security-command-center/docs/quickstart-security-command-center).
29+
Without doing so, you may run into errors during resource creation.
30+
references: !ruby/object:Api::Resource::ReferenceLinks
31+
guides:
32+
'Official Documentation': 'https://cloud.google.com/security-command-center/docs/how-to-analyze-findings-in-big-query'
33+
api: 'https://cloud.google.com/security-command-center/docs/reference/rest/v1/organizations.bigQueryExports'
34+
examples:
35+
- !ruby/object:Provider::Terraform::Examples
36+
name: 'scc_organization_big_query_export_config_basic'
37+
primary_resource_id: 'custom_big_query_export_config'
38+
external_providers: ["random", "time"]
39+
skip_test: true
40+
vars:
41+
big_query_export_id: 'my-export'
42+
dataset: 'my-dataset'
43+
name: 'my-export'
44+
test_env_vars:
45+
org_id: :ORG_ID
46+
project: :PROJECT_NAME
47+
parameters:
48+
- !ruby/object:Api::Type::String
49+
name: organization
50+
required: true
51+
immutable: true
52+
url_param_only: true
53+
description: |
54+
The organization whose Cloud Security Command Center the Big Query Export
55+
Config lives in.
56+
- !ruby/object:Api::Type::String
57+
name: bigQueryExportId
58+
required: true
59+
immutable: true
60+
url_param_only: true
61+
description: |
62+
This must be unique within the organization.
63+
properties:
64+
- !ruby/object:Api::Type::String
65+
name: name
66+
output: true
67+
description: |
68+
The resource name of this export, in the format
69+
`organizations/{{organization}}/bigQueryExports/{{big_query_export_id}}`.
70+
This field is provided in responses, and is ignored when provided in create requests.
71+
- !ruby/object:Api::Type::String
72+
name: description
73+
description: |
74+
The description of the notification config (max of 1024 characters).
75+
validation: !ruby/object:Provider::Terraform::Validation
76+
function: 'validation.StringLenBetween(0, 1024)'
77+
- !ruby/object:Api::Type::String
78+
name: dataset
79+
description: |
80+
The dataset to write findings' updates to.
81+
Its format is "projects/[projectId]/datasets/[bigquery_dataset_id]".
82+
BigQuery Dataset unique ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_).
83+
- !ruby/object:Api::Type::String
84+
name: createTime
85+
output: true
86+
description: |
87+
The time at which the BigQuery export was created. This field is set by the server and will be ignored if provided on export on creation.
88+
A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
89+
Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
90+
- !ruby/object:Api::Type::String
91+
name: updateTime
92+
output: true
93+
description: |
94+
The most recent time at which the BigQuery export was updated. This field is set by the server and will be ignored if provided on export creation or update.
95+
A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits.
96+
Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
97+
- !ruby/object:Api::Type::String
98+
name: mostRecentEditor
99+
output: true
100+
description: |
101+
Email address of the user who last edited the BigQuery export.
102+
This field is set by the server and will be ignored if provided on export creation or update.
103+
- !ruby/object:Api::Type::String
104+
name: principal
105+
output: true
106+
description: |
107+
The service account that needs permission to create table and upload data to the BigQuery dataset.
108+
- !ruby/object:Api::Type::String
109+
name: filter
110+
description: |
111+
Expression that defines the filter to apply across create/update
112+
events of findings. The
113+
expression is a list of zero or more restrictions combined via
114+
logical operators AND and OR. Parentheses are supported, and OR
115+
has higher precedence than AND.
116+
117+
Restrictions have the form <field> <operator> <value> and may have
118+
a - character in front of them to indicate negation. The fields
119+
map to those defined in the corresponding resource.
120+
121+
The supported operators are:
122+
123+
* = for all value types.
124+
* \>, <, >=, <= for integer values.
125+
* :, meaning substring matching, for strings.
126+
127+
The supported value types are:
128+
129+
* string literals in quotes.
130+
* integer literals without quotes.
131+
* boolean literals true and false without quotes.
132+
133+
See
134+
[Filtering notifications](https://cloud.google.com/security-command-center/docs/how-to-api-filter-notifications)
135+
for information on how to write a filter.

‎mmv1/templates/terraform/examples/scc_organization_big_query_export_config_basic.tf.erb

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
resource "google_bigquery_dataset" "default" {
2+
dataset_id = "<%= ctx[:vars]['dataset_id'] %>"
3+
friendly_name = "test"
4+
description = "This is a test description"
5+
location = "US"
6+
default_table_expiration_ms = 3600000
7+
default_partition_expiration_ms = null
8+
9+
labels = {
10+
env = "default"
11+
}
12+
13+
lifecycle {
14+
ignore_changes = [default_partition_expiration_ms]
15+
}
16+
}
17+
18+
resource "google_scc_organization_scc_big_query_export" "<%= ctx[:primary_resource_id] %>" {
19+
name = "<%= ctx[:vars]['name'] %>"
20+
big_query_export_id = "<%= ctx[:vars]['big_query_export_id'] %>"
21+
organization = "<%= ctx[:test_env_vars]['org_id'] %>"
22+
dataset = google_bigquery_dataset.default.id
23+
description = "Cloud Security Command Center Findings Big Query Export Config"
24+
filter = "state=\"ACTIVE\" AND NOT mute=\"MUTED\""
25+
}

‎mmv1/third_party/terraform/services/securitycenter/resource_scc_organization_big_query_export_config_test.go

+124
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
package securitycenter_test
2+
3+
import (
4+
"fmt"
5+
"testing"
6+
7+
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
8+
"github.com/hashicorp/terraform-provider-google/google/acctest"
9+
"github.com/hashicorp/terraform-provider-google/google/envvar"
10+
)
11+
12+
func TestAccSecurityCenterOrganizationBigQueryExportConfig_basic(t *testing.T) {
13+
t.Parallel()
14+
15+
randomSuffix := acctest.RandString(t, 10)
16+
dataset_id := "tf_test_" + randomSuffix
17+
orgID := envvar.GetTestOrgFromEnv(t)
18+
19+
context := map[string]interface{}{
20+
"org_id": orgID,
21+
"random_suffix": randomSuffix,
22+
"dataset_id": dataset_id,
23+
"big_query_export_id": "tf-test-export-" + randomSuffix,
24+
"name": fmt.Sprintf("organizations/%s/bigQueryExports/%s",
25+
orgID, "tf-test-export-"+randomSuffix),
26+
}
27+
28+
acctest.VcrTest(t, resource.TestCase{
29+
PreCheck: func() { acctest.AccTestPreCheck(t) },
30+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
31+
ExternalProviders: map[string]resource.ExternalProvider{
32+
"random": {},
33+
"time": {},
34+
},
35+
Steps: []resource.TestStep{
36+
{
37+
Config: testAccSecurityCenterOrganizationBigQueryExportConfig_basic(context),
38+
},
39+
{
40+
ResourceName: "google_scc_organization_scc_big_query_export.default",
41+
ImportState: true,
42+
ImportStateVerify: true,
43+
ImportStateVerifyIgnore: []string{"update_time"},
44+
},
45+
{
46+
Config: testAccSecurityCenterOrganizationBigQueryExportConfig_update(context),
47+
},
48+
{
49+
ResourceName: "google_scc_organization_scc_big_query_export.default",
50+
ImportState: true,
51+
ImportStateVerify: true,
52+
ImportStateVerifyIgnore: []string{"update_time"},
53+
},
54+
},
55+
})
56+
}
57+
58+
func testAccSecurityCenterOrganizationBigQueryExportConfig_basic(context map[string]interface{}) string {
59+
return acctest.Nprintf(`
60+
61+
resource "google_bigquery_dataset" "default" {
62+
dataset_id = "%{dataset_id}"
63+
friendly_name = "test"
64+
description = "This is a test description"
65+
location = "US"
66+
default_table_expiration_ms = 3600000
67+
default_partition_expiration_ms = null
68+
69+
labels = {
70+
env = "default"
71+
}
72+
73+
lifecycle {
74+
ignore_changes = [default_partition_expiration_ms]
75+
}
76+
}
77+
78+
resource "time_sleep" "wait_1_minute" {
79+
depends_on = [google_bigquery_dataset.default]
80+
create_duration = "3m"
81+
}
82+
83+
resource "google_scc_organization_scc_big_query_export" "default" {
84+
big_query_export_id = "%{big_query_export_id}"
85+
organization = "%{org_id}"
86+
dataset = google_bigquery_dataset.default.id
87+
description = "Cloud Security Command Center Findings Big Query Export Config"
88+
filter = "state=\"ACTIVE\" AND NOT mute=\"MUTED\""
89+
90+
depends_on = [time_sleep.wait_1_minute]
91+
}
92+
93+
`, context)
94+
}
95+
96+
func testAccSecurityCenterOrganizationBigQueryExportConfig_update(context map[string]interface{}) string {
97+
return acctest.Nprintf(`
98+
99+
resource "google_bigquery_dataset" "default" {
100+
dataset_id = "%{dataset_id}"
101+
friendly_name = "test"
102+
description = "This is a test description"
103+
location = "US"
104+
default_table_expiration_ms = 3600000
105+
default_partition_expiration_ms = null
106+
107+
labels = {
108+
env = "default"
109+
}
110+
111+
lifecycle {
112+
ignore_changes = [default_partition_expiration_ms]
113+
}
114+
}
115+
116+
resource "google_scc_organization_scc_big_query_export" "default" {
117+
big_query_export_id = "%{big_query_export_id}"
118+
organization = "%{org_id}"
119+
dataset = google_bigquery_dataset.default.id
120+
description = "SCC Findings Big Query Export Update"
121+
filter = "state=\"ACTIVE\" AND NOT mute=\"MUTED\""
122+
}
123+
`, context)
124+
}

0 commit comments

Comments
 (0)